Scope: real Linux TCP on owned A/B network namespaces and one veth pair.
A=10.17.0.1, B=10.17.0.2:46017. No host route or production traffic.
Environment: Linux 6.18.10-200.fc43.aarch64, Python 3.14.3,
iproute2 6.14.0, nftables 1.1.3. No dependency installed.
Run: sudo python3 lab.py in the dedicated Podman VM. The enclosing shell
started podman-machine-default, ran SSH, and stopped it with an EXIT trap.
Final complete run exited 0 and printed Machine stopped successfully.

Both AF_PACKET readers report READY before sockets connect. Both socket
processes report CONNECTED before injection. The parent installs and reads
back the rule before releasing GO. Each sender transmits actual 32-byte
0123456789abcdef0123456789abcdef; B receives and echoes its received bytes.
Both applications compare actual received bytes, then a second GO permits
half-closing and EOF checks. No fixed sleep chooses when to inject or send.

Delay case net17-6a0ef6e3:
A/eth0 root netem limit 100 delay 80ms, installed after handshake.
Both A and B capture one A-to-B data segment, SEQ 1674782394, payload 32B.
Client send/receive operation duration 83.313680ms; server operation 83.298429ms.
Readback after application completion: sent 98 bytes/1 packet, dropped 0,
backlog 66 bytes/1 packet. This snapshot precedes close; the queued ACK and
close traffic remain subject to the qdisc. It is not a final empty-queue claim.
No same-payload retransmission or RST appeared within the captured interval.

Drop case net17-7fba1920:
B namespace nft input hook, priority 0, accept policy. Exact installed rule
and readback are in run.jsonl. Source10.17.0.1, destination port46017,
ip length >60, flags exclude SYN/FIN/RST, numgen inc mod100==0, counter drop.
The generator is periodic: matching packets 1,101,... are selected, not an
unconditional one-shot rule. This bounded run read back counter packets1
bytes84; it actually dropped exactly one matching packet. The size selector
is only valid for identifying this controlled IPv4/TCP data case: it is not
a general TCP-data predicate for arbitrary options or packet sizes.
Both captures observed SEQ3973772351 and the same32B payload twice.
A user-space observation gap205.735622ms; B gap205.714080ms.
Client operation205.910747ms; server205.902872ms. Application bytes matched.
No RST was observed in either final-run trace. All original frames retained.

AF_PACKET on B sees traffic before nft input filtering, so seeing the first
packet at B does not prove TCP or the receiving application accepted it.
The drop counter, duplicate sequence/payload observation, and eventual actual
application read are distinct evidence. A capture is also not guaranteed to
observe an outgoing packet before its qdisc delay. The first A-to-B sample
comparison in the delay case was -0.004167ms because independent user-space
readers were scheduled differently; it must not be treated as wire latency.
Each time_ns is monotonic_ns taken after recv, not a kernel/hardware transmit
timestamp. Operation durations include scheduling and barrier overhead.
This short flow and these observations do not uniquely identify RTO, RACK,
TLP, fast retransmit or the exact Linux recovery branch. No claim of three
qualifying duplicate ACKs, TCP_INFO state, tracepoint proof or public-network
performance. The parser covers untagged, unfragmented IPv4/TCP used here;
checksums, TCP option decoding and offload behavior are not validated.

Execution failures preserved as facts: first and second attempts passed the
delay scenario but nft loading failed before drop-case application data.
Initially stderr was captured without printing; after exposing it, nft
reported unexpected '}', expecting newline or semicolon at the inner-chain
closing boundary. Adding a newline between chain and table closing braces
fixed the syntax; final run completed both cases. Those failed attempts also
cleaned their namespaces and stopped the VM. Partial JSONL is preserved at
/tmp/net17-first-run.jsonl and /tmp/net17-second-run.jsonl for this session;
run.jsonl contains only the final complete successful run.
Final run logged removal of all four owned namespaces. Child processes have
bounded command/socket deadlines, capture deadline25s and frame bound256;
finally terminates remaining owned children and removes only owned namespaces.
CLI: --help exit0; --bad exit2; macOS default exit1 before network mutation.
Python no-excuse checker: zero violations. No commit or push by this worker.

Sources checked during this writing:
https://netfilter.org/projects/nftables/manpage.html
https://man7.org/linux/man-pages/man8/tc-netem.8.html